Virus monitor and methods of use thereof

Abstract

A network level virus monitoring system capable of monitoring a flow of network traffic in any of a number of inspection modes depending upon the particular needs of a system administrator. The monitoring provides an early warning of a virus attack thereby facilitating quarantine procedures directed at containing a virus outbreak. By providing such an early warning, the network virus monitor reduces the number of computers ultimately affected by the virus attack resulting in a concomitant reduction in both the cost of repair to the system and the amount of downtime. In this way, the inventive network virus monitor provides a great improvement in system uptime and reduction in system losses.

Description

CROSS REFERENCE TO RELATED APPLICATIONS [0001] This application takes priority under 35 U.S.C. §119(e) of U.S. Patent Application No. 60 / 481,313 filed Aug. 29, 2003 (Attorney Docket No.: TRNDP009P) naming Liang et al. as inventor(s) entitled “VIRUS MONITOR AND METHODS OF USE THEREOF” which is also incorporated herein by reference for all purposes. This application is also related to the following co-pending U.S. patent applications, which are filed concurrently with this application and each of which are herein incorporated by reference, (i) U.S. patent application Ser. No. ______ (Attorney Docket No.: TRNDP010), entitled “AUTOMATIC REGISTRATION OF A VIRUS / WORM MONITOR IN A DISTRIBUTED NETWORK” naming Liang et al as inventors; (ii) U.S. patent application Ser. No. ______ (Attorney Docket No.: TRNDP011), entitled “NETWORK TRAFFIC MANAGEMENT BY A VIRUS / WORM MONITOR IN A DISTRIBUTED NETWORK” naming Liang et al as inventors; (iii) U.S. patent application Ser. No. ______ (Attorney Docket...

AI Technical Summary

Benefits of technology

[0016] In another embodiment of the invention, a method of monitoring a distributed network of computing devices for a computer virus is described made operable by at least the following operations. At a virus monitor coupled to the distributed network, monitoring a flow of data packets in the network for the computer virus without substantially reducing the flow of data packets thereby preserving network bandwidth in a standby mode, determining that at least one of the monitored data packets is infected with the computer virus, and monitoring the flow of data packets such that the infected data packets are not returned to the flow of data packets in an inline mode based upon the determining.

[0017] In yet another e

Problems solved by technology

However, there exists a class of executable code that, if downloaded and executed at host computers, may wreak havoc with the operating system, the hardware, and/or other software of the host computers.

A computer virus is a piece of programming code usually disguised as something else that causes some unexpected and usually undesirable event (for the victim).

Some viruses can be quite harmful, causing a hard disk to require reformatting or clogging networks with unnecessary traffic.

Therefore, it is common for worms to be noticed only when their uncontrolled replication consumes system resources, slowing or halting other tasks.

Even in the case of corporate networks that are closely guarded by an anti-virus firewall and various other virus protecti

Images